[PATCH net-next v2] net: ethernet: mtk-star-emac: fix device_node leak in mtk_star_probe()

[PATCH net-next v2] net: ethernet: mtk-star-emac: fix device_node leak in mtk_star_probe()

[Xia Yan]

mtk_star_probe() gets the PHY node from the "phy-handle" property
with of_parse_phandle(). The helper takes a reference on the node it
returns. The node is used by of_phy_connect() each time the netdevice
is opened.

That reference is never dropped. Every error return after the lookup
leaks it. Unbind leaks it as well: the driver is devm-only and has no
remove callback.

Release it with a devm action, registered right after the lookup.
The error paths and the unbind path then drop the node through the
devm cleanup.

Found during a code review of the OF node handling in ethernet drivers.

Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver")
Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>
---
Changes in v2:
- Add the missing Fixes: tag.

v1: https://lore.kernel.org/netdev/1794061182000.57993.3986467551914992480@cmss.chinamobile.com/

 drivers/net/ethernet/mediatek/mtk_star_emac.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/ethernet/mediatek/mtk_star_emac.c b/drivers/net/ethernet/mediatek/mtk_star_emac.c
index b83886a41121..bac4a24c5979 100644
--- a/drivers/net/ethernet/mediatek/mtk_star_emac.c
+++ b/drivers/net/ethernet/mediatek/mtk_star_emac.c
@@ -1501,6 +1501,11 @@
 	clk_bulk_disable_unprepare(MTK_STAR_NCLKS, priv->clks);
 }
 
+static void mtk_star_of_node_put(void *data)
+{
+	of_node_put(data);
+}
+
 static int mtk_star_set_timing(struct mtk_star_priv *priv)
 {
 	struct device *dev = mtk_star_get_dev(priv);
@@ -1603,6 +1608,11 @@
 		return -ENODEV;
 	}
 
+	ret = devm_add_action_or_reset(dev, mtk_star_of_node_put,
+				       priv->phy_node);
+	if (ret)
+		return ret;
+
 	priv->rmii_rxc = of_property_read_bool(of_node, "mediatek,rmii-rxc");
 	priv->rx_inv = of_property_read_bool(of_node, "mediatek,rxc-inverse");
 	priv->tx_inv = of_property_read_bool(of_node, "mediatek,txc-inverse");

Re: [PATCH net-next v2] net: ethernet: mtk-star-emac: fix device_node leak in mtk_star_probe()

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net-next v2] net: ethernet: mtk-star-emac: fix device_node leak in mtk_star_probe()

[Xia Yan]

On 11/12/26 12:13, netdev-bot+sinfo wrote:
>  - What hardware the change was tested on. For driver fixes please
>    mention the device (and if relevant firmware version) used for
>    testing, or say that the change was not tested on real hardware.

Hi,

I don't have any MediaTek hardware with this Ethernet MAC, so the
change is compile-tested only, with CONFIG_NET_MEDIATEK_STAR_EMAC
enabled on x86_64.

Thanks,
Xia Yan

Re: [PATCH net-next v2] net: ethernet: mtk-star-emac: fix device_node leak in mtk_star_probe()

[Bartosz Golaszewski]

On Thu, Nov 12, 2026 at 11:51:30AM +0800, Xia Yan wrote:
> mtk_star_probe() gets the PHY node from the "phy-handle" property
> with of_parse_phandle(). The helper takes a reference on the node it
> returns. The node is used by of_phy_connect() each time the netdevice
> is opened.
> 
> That reference is never dropped. Every error return after the lookup
> leaks it. Unbind leaks it as well: the driver is devm-only and has no
> remove callback.
> 
> Release it with a devm action, registered right after the lookup.
> The error paths and the unbind path then drop the node through the
> devm cleanup.
> 
> Found during a code review of the OF node handling in ethernet drivers.
> 
> Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver")
> Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> 

Re: [PATCH net-next v2] net: ethernet: mtk-star-emac: fix device_node leak in mtk_star_probe()

[Lorenzo Bianconi]

[-- Attachment #1: Type: text/plain, Size: 1001 bytes --]

> On Thu, Nov 12, 2026 at 11:51:30AM +0800, Xia Yan wrote:
> > mtk_star_probe() gets the PHY node from the "phy-handle" property
> > with of_parse_phandle(). The helper takes a reference on the node it
> > returns. The node is used by of_phy_connect() each time the netdevice
> > is opened.
> > 
> > That reference is never dropped. Every error return after the lookup
> > leaks it. Unbind leaks it as well: the driver is devm-only and has no
> > remove callback.
> > 
> > Release it with a devm action, registered right after the lookup.
> > The error paths and the unbind path then drop the node through the
> > devm cleanup.
> > 
> > Found during a code review of the OF node handling in ethernet drivers.
> > 
> > Fixes: 8c7bd5a454ff ("net: ethernet: mtk-star-emac: new driver")
> > Signed-off-by: Xia Yan <yanxia@cmss.chinamobile.com>
> > ---
> 
> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> 

Reviewed-by: Lorenzo Bianconi <lorenzo@kernel.org>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]